lerko
32982228b0
## Summary - Upgrade `golang.org/x/net` v0.54.0 → v0.55.0 — patches 6 CVEs including critical CVE-2026-41589 (CVSS 9.6) - Remove `openssh-client` from Docker image — unused (uptop uses pure Go SSH), eliminates 4 CVEs - Add `apk upgrade` to Dockerfile for remaining Alpine package CVEs ## CVEs Resolved | CVE | Severity | Package | Fix | |-----|----------|---------|-----| | CVE-2026-41589 | 9.6 Critical | golang.org/x/net | upgraded to v0.55.0 | | CVE-2025-60876 | 6.5 Medium | golang.org/x/net | upgraded to v0.55.0 | | CVE-2026-42502 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 | | CVE-2026-42506 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 | | CVE-2026-25681 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 | | CVE-2026-35414 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 | | CVE-2026-25680 | 7.5 High | alpine/openssh | removed openssh-client | | CVE-2026-35386 | 3.6 Low | alpine/openssh | removed openssh-client | | CVE-2026-35387 | 3.1 Low | alpine/openssh | removed openssh-client | | CVE-2026-35388 | 2.5 Low | alpine/openssh | removed openssh-client | | CVE-2026-27136 | 6.5 Medium | alpine/busybox | apk upgrade | ## Not Addressed (not exploitable) CVE-2026-35385 (charmbracelet/wish v1.4.7, CVSS 9.6) — path traversal in wish's SCP middleware. uptop does not use the SCP middleware, only wish core + bubbletea middleware. Vulnerable code path is never loaded. Migration to wish v2 tracked in #42. ## Test Plan - [x] `go build ./...` passes - [x] `go test ./...` passes - [ ] Rebuild Docker image, re-scan with Docker Scout Reviewed-on: #41
62 lines
2.6 KiB
Modula-2
62 lines
2.6 KiB
Modula-2
module gitea.lerkolabs.com/lerkolabs/uptop
|
|
|
|
go 1.26.3
|
|
|
|
require (
|
|
github.com/charmbracelet/bubbles v0.21.1-0.20250623103423-23b8fd6302d7
|
|
github.com/charmbracelet/bubbletea v1.3.10
|
|
github.com/charmbracelet/harmonica v0.2.0
|
|
github.com/charmbracelet/huh v1.0.0
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/charmbracelet/ssh v0.0.0-20250826160808-ebfa259c7309
|
|
github.com/charmbracelet/wish v1.4.7
|
|
github.com/lib/pq v1.11.1
|
|
github.com/lrstanley/bubblezone v1.0.0
|
|
github.com/mattn/go-isatty v0.0.20
|
|
github.com/mattn/go-sqlite3 v1.14.33
|
|
github.com/miekg/dns v1.1.72
|
|
github.com/prometheus-community/pro-bing v0.8.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/catppuccin/go v0.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.3.1 // indirect
|
|
github.com/charmbracelet/keygen v0.5.3 // indirect
|
|
github.com/charmbracelet/log v0.4.2 // indirect
|
|
github.com/charmbracelet/x/ansi v0.10.1 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
|
|
github.com/charmbracelet/x/conpty v0.1.0 // indirect
|
|
github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 // indirect
|
|
github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
|
|
github.com/charmbracelet/x/input v0.3.4 // indirect
|
|
github.com/charmbracelet/x/term v0.2.1 // indirect
|
|
github.com/charmbracelet/x/termios v0.1.1 // indirect
|
|
github.com/charmbracelet/x/windows v0.2.0 // indirect
|
|
github.com/creack/pty v1.1.24 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/go-logfmt/logfmt v0.6.0 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
golang.org/x/crypto v0.52.0 // indirect
|
|
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
|
|
golang.org/x/mod v0.35.0 // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
golang.org/x/tools v0.44.0 // indirect
|
|
)
|